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The Purposes of 
the Acts 


The purposes of the Freedom of Information and Protection of Privacy Act and the 


Municipal Freedom of Information and Protection of Privacy Act are: 


a) To provide a right of access to information under the control of government organizations 


in accordance with the following principles: 
- information should be available to the public; 
+ exemptions to the right of access should be limited and specific; 


+ decisions on the disclosure of government information may be reviewed by the Information 


and Privacy Commissioner. 


b) To protect personal information held by government organizations and to provide individuals 


with a right of access to their own personal information. 
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Role and Mandate 


Ontario’s Freedom of Information and Protection of 
Privacy Act, which came into effect on January 1, 
1988, established an Information and Privacy 
Commissioner as an officer of the Legislature to 
provide an independent review of the decisions and 
practices of government organizations concerning 
access and privacy. The Commissioner is appointed 
by and reports to the Legislative Assembly of Ontario. 
The Commissioner is independent of the government 
of the day in order to ensure impartiality. 

The Municipal Freedom of Information and Protection 
of Privacy Act, which came into effect January 1, 1991, 
broadened the number of public institutions covered 
by Ontario’s access and privacy legislation. 

The Information and Privacy Commissioner 
(IPC) plays a crucial role under the two Acts. Together, 
the Acts establish a system for public access to govern- 
ment information, with limited exemptions, and for 
protecting personal information held by government 
organizations at the provincial or municipal level. 

The provincial Act applies to all provincial min- 
istries and most provincial agencies, boards and com- 
missions; colleges of applied arts and technology; and 
district health councils. The municipal Act covers local 
government organizations, such as municipalities; 
police, library, health and school boards; public utili- 
ties; and transit commissions. 

Freedom of information refers to public access 
to general records relating to the activities of govern- 
ment, ranging from administration and operations 
to legislation and policy. The underlying objective is 
open government and holding elected and appointed 
officials accountable to the people they serve. 


Privacy protection, on the other hand, refers to 


the safeguarding of personal information — that is, 
data about individuals held by government organiza- 
tions. The Acts establish rules about how government 
organizations may collect, and disclose personal data. 
In addition, individuals have a right to see their own 
personal information and are entitled to have it cor- 
rected if necessary. 

The mandate of the IPC is to provide an indepen- 
dent review of government decisions and practices 
concerning access and privacy. To safeguard the rights 
established under the Acts, the IPC has five key roles: 


resolving appeals when government organizations 


refuse to grant access to information; 


investigating privacy complaints about govern- 


ment-held information; 


* ensuring that government organizations comply 
with the Acts; 


+ conducting research on access and privacy issues 
and providing advice on proposed government 


legislation and programs; 


educating the public about Ontario’s access and 


privacy laws and access and privacy issues. 


In accordance with the legislation, the Commissioner 
delegated some of the decision-making powers to 
various staff. Thus, the Assistant Commissioner and 
selected staff were given the authority to assist her 
by issuing orders, resolving appeals and investigating 
privacy complaints. Under the authority of the Commis- 
sioner, government practices were reviewed, and pro- 


posed inter-ministry computer matches commented on. 
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Commissioner’s 
Message 


The issues of access and privacy have never been more topical and relevant to people in their daily 


lives. The falling cost (and increasing power) of computers and telecommunications, privatiza- 


tion of public services, the rapid development of electronic commerce, the accelerating pace of 


the move from paper to electronic records, and the expansion of online government programs 


and services have dramatically altered the landscape with which people interact day to day. As the 


pace of change increases dramatically, so do the risks and opportunities that flow from it. Let me 


share some observations on the events of 1998, and some thoughts about the future. 


Issues 


In response to an increasingly complicated world, the 
IPC has renewed and expanded its focus on public 
education and outreach initiatives. In keeping with 
this effort, this year’s annual report highlights five key 
issues that are of particular interest to the IPC and, I 
believe, to the public at large. These issues have rele- 
vance far beyond the calendar year addressed by this 
report. Following a discussion of these issues, another 
new section — Commissioner’s Recommendations — 
offers a number of concrete steps that the government 
could take to address them. The five issues I have cho- 
sen to highlight this year are: 1) Privacy Safeguards in 
the Private Sector, 2) Quality Service for Freedom of 
Information, 3) How Technology Can Help Protect 
Privacy, 4) Deference to the IPC and, 5) Access and 
Privacy Today. 


IPC in the Classroom 


As part of an expansion of our outreach program, we 
launched two major initiatives in the education field in 
1998. The IPC approached the Ministry of Education 
and Training last spring about including information 
on access and privacy in the civics course being devel- 
oped as part of the new secondary school curriculum. 
We continued to provide input throughout the consul- 
tation process as curriculum guidelines were drafted. 


We were successful, and I am delighted to report that 


all Ontario students will have the opportunity to study 
the area of access and privacy as part of the new, 
mandatory Grade Io civics course. The new course 
will be introduced in the 2000-2001 school year. 

The second major education initiative is one that 
has been a special focus of our Tribunal Services 
Department. Ask an Expert is a special speakers pro- 
gram aimed at students in Grades 5 and 10, when the 
concepts of government and civics are first introduced 
in the classroom. With help from curriculum special- 
ists and classroom teachers, kits have been developed 
which will help teachers introduce students to the 
topics, and a speaker from the Tribunal Services 
Department will attend to round out the discussions. 
Our goal is to give students a basic understanding of 
why open government and personal privacy are impor- 
tant values to both themselves and to society. Having 
made a presentation to students at Leaside High 
School in the fall, I experienced first-hand the value of 
communicating these important messages to young 
adults. If they can learn about the importance of 
access and privacy at a young age, today’s students will 
be more likely to ensure that these issues maintain a 


prominent place on the political agenda of tomorrow. 


Privacy and the Online World 


With each passing year, the issue of protecting privacy 
online gains prominence and increased attention. A 


simple Web search reveals tens of thousands of refer- 


ences to Web sites dealing with access and privacy 
matters. Newspapers and magazines are full of stories 
on these issues. Discussions on these topics are no 
longer constrained to a small, esoteric group, but have 
become embraced by business professionals, techno- 
logists, lawyers, and the general public alike. With 
the introduction of federal privacy legislation for the 
private sector (Bill C-54), the Government of Canada is 
working to expand personal privacy protections to 
cover commercial activities in the private sector. 

Companies around the world are trying to make 
cyberspace “safe” and secure for electronic commerce. 
Other firms are devising ways for people to surf on- 
line anonymously, or at least control the release of 
information about themselves via an infomediary 
(information intermediary). Over the next few years, a 
range of privacy-enhancing technologies will become 
widely available. “Cloaking devices” will allow you 
to conceal your identity behind a pseudonym. Other 
technologies, such as intelligent software agents, will 
be used by people seeking to automate many of their 
routine tasks. These and other emerging technologies 
also have the potential to facilitate access to personal 
information, and in so doing, can both threaten and 
protect your privacy. The IPC will continue to monitor 
technological developments and comment on the 
good, the bad, and the ugly. 


Changes at the Commission 


Our Tribunal Services Department successfully 
implemented a number of revisions to its processes 
in order to streamline operations and enhance the 
focus on mediation as the preferred method of dispute 
resolution. We also restructured what were separate 
policy and compliance departments, combining them 
into one, with responsibility to conduct research and 
analysis on current issues, perform compliance audits, 
and monitor government requests for proposals 
(RFPs). The Policy and Compliance Department also 
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works closely with our Communications Department 
to produce a range of publications, including policy 
papers and a new series of short reports called, If you 
wanted to know... A number of new outreach programs, 
co-ordinated by our Communications Department, 
have also been implemented. In addition, you now 
have the option of receiving all of our IPC publications 
electronically. 

One of the ways in which the IPC stays on top of 
new technological developments, be it smart cards, 
anonymizing technologies, infomediaries, intelligent 
software agents, biometrics or encryption systems, is 
through a new program we launched in 1998 
where leading technology companies are invited to 
give presentations and briefing sessions at the IPC. 
Among the companies that have already participated 
in this new program are IBM, Intel, KPMG, and Zero 
Knowledge Systems. 


- 


With each passing year, the issue of protecting privacy 
online gains prominence and increased attention. À simple 
Web search reveals tens of thousands of references to Web 
sites dealing with access and privacy matters. 


Personal Thanks 


I would like to personally thank each and every mem- 
ber of the IPC team — we simply couldn’t do our fine 
work without your efforts. I would also like to extend 
my thanks to the Corporate Freedom of Information 
and Privacy Office at Management Board Secretariat, 
and information and privacy co-ordinators at all gov- 


ernment organizations for their ongoing efforts to 


uphold the public’s rights to access to government 


information and protection of personal information. 


Key Issues 


Privacy Safeguards in the Private Sector 


Major steps are being taken in a number of countries to create or upgrade privacy safeguards 


in the private sector. Before we look at Ontario, let’s go well beyond our borders. 


The European Union’s Directive on the Protection of 
Individuals with regard to the processing of personal data 
and on the free movement of such data came into force 
on October 25, 1998. The legislation applies to both 
the public and private sectors. The Directive compels 
each member country to establish or revise its nation- 
al data protection legislation so that it is in accord with 
the Directive. The principal aim is to harmonize 
national legislation so that fundamental data protec- 
tion principles are uniformly matched across the 
European Union (E.U.). This is being done to give 
effect to the second part of the Directive’s objective, 
namely to ensure that personal data moving from 
member country to member country is afforded equal 
data protection. Such harmonization of laws will assist 
in the creation of a single market for the entire E.U. 

In light of the E.U.’s concern for uniformity of 
approach to data protection, it has sought to apply this 
same approach to transfers of personal information 
outside of the E. U., to non-member countries. The 
Directive has adopted a standard by which to judge 
whether such transfers are permissible. The third 
country’s privacy or data protection regime must be 
judged to be “adequate” before such transfers will be 
allowed under European law. 

Information transfers of one kind or another are 
a daily occurrence in this age of globalization and 
information technologies. Having a country’s privacy 
regime judged to be ‘inadequate’ could result in the 
disruption of flows of personal information, with 


attendant financial, trade, and economic losses. 


Over the past year, a number of non-European 
Union countries have sought ways to ensure that their 
privacy regimes will be judged to be adequate. The 
most controversy surrounds the efforts of the U.S. 
government and private sector to avoid the introduc- 
tion of comprehensive legislation for the private 
sector, and to rely on industry self-regulation as the 
way to meet the adequacy standard. While the E.U. has 
not completely ruled out a self-regulatory approach, it 
has asked that the U.S. proposals be considerably 
strengthened. It is still too early to tell what the final 
outcome of negotiations between the U.S. and the 
European Union will be. Stay tuned. 

In Canada, the federal government introduced 
Bill C-54, The Personal Information Protection and 
Electronic Documents Act, in part as Canada’s response 
to the European Union’s Directive. Recognizing the 
future economic impact of electronic commerce, the 
government of Canada has sought to ensure that pri- 
vacy considerations are embedded in the transactions 
that will be conducted over the World Wide Web. It 
has been generally recognized that without high levels 
of trust and privacy, this new way of doing business 
will not receive the full support of the general public. 
At the same time, since electronic commerce knows 
no borders, alignment of Canada’s privacy regime 
with that of the E.U. will ensure that the flow of per- 
sonal information between Canada and the countries 
of the European Union will remain intact. 

Bill C-54 would protect the privacy of personal 
information which is collected, used or disclosed in the 
private sector, to permit business to be conducted with 
the federal government by electronic means and to clar- 


ify how electronic records may be used as evidence. 


Upon coming into force, the Act will apply to all 
federally regulated businesses using or requiring 
personal information for commercial activities within 
more than one province. Three years after this date, the 
Act will apply to all provincially regulated businesses as 
well, unless the province has already enacted compara- 
ble legislation. 


Ontario’s Perspective 


From Ontario’s perspective, defaulting to federal 
legislation after three years may not be in the best 
interests of Ontario residents. For more than a decade, 
Ontarians have learned how to deal with provincial 
privacy legislation in the public sector, and would 
undoubtedly find it confusing to deal with separate 
federal legislation covering the private sector. The 
Information and Privacy Commissioner/Ontario is 
encouraging the Ontario Government to adopt its own 
comparable legislation. 

One of the motivating factors for such considera- 
tion is the proposed method of handling privacy com- 
plaints. The person to whom the public would complain 
about a contravention of Bill C-54 would be the federal 
Privacy Commissioner. The federal Commissioner 
would investigate and file a report with recommenda- 
tions. The complainant, if unsatisfied, could then, with 
the assistance of the Commissioner, apply to the 
Federal court for a hearing. The Court would have 
power to order the organization to correct its practices 
and to pay damages. The federal Privacy Commissioner 
would also have the authority to conduct audits of an 
organization’s practices, if the Commissioner had 
grounds to believe that the organization was not com- 


plying with the legislation. 


To split the jurisdiction for the handling of privacy 
complaints between the Ontario Information and 
Privacy Commissioner, responsible for the Ontario pub- 
lic sector, and the federal Privacy Commissioner, who 
would be responsible for the provincial private sector, 
would create considerable confusion. At the same time, 
it would be advantageous if the Ontario Information 
and Privacy Commissioner developed provincial exper- 
tise in dealing with the Ontario private sector. This is 
particularly important given that Bill C-54 is based on 
the Canadian Standards Association model privacy 
code, an industry-accepted code that provides flexibility 
in implementation. It would be fair to say that the 
Ontario Information and Privacy Commissioner would 


likely be more responsive to local circumstances. 


Bill C-54 would protect the privacy of personal information 
which is collected, used or disclosed in the private sector, to 
permit business to be conducted with the federal government 
by electronic means and to clarify how electronic records may 
be used as evidence. 


Once adopted, Bill C-54 would usher in a new era 
in privacy protection in Canada. Existing public sector 
privacy legislation would be parallelled by private sector 
privacy legislation. Personal information, irrespective 
of where it was collected, used or disclosed, would be 
given the same protections. Such protections would go 
a long way towards assuring the general public that its 
personal information will be similarly treated whether 


it resides in the public or private sectors. 
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Key Issues 


Quality Service for Freedom of Information 


Quality customer service in the public sector is a high priority for the Ontario government. 


In a moment, we'll look at customer service as it 
relates to the time it takes for ministries to respond to 
freedom of information requests, but first, let’s look at 
the government’s commitment to quality service. 

In the October 27, 1998 edition of the OPS inter- 
nal newsletter, Topical, the government announced 
two initiatives as part of its “Quality Service” program. 

The first involves five ministries running pilot pro- 
jects to test the assumptions underlying the govern- 
ment’s Quality Service Framework. These ministries 
were asked to examine all aspects of service delivery and 
assess how they measure up to the cornerstones of qual- 
ity service — leadership, delivering customer-focussed 
services, streamlining processes, etc. After the six-month 
pilot period is completed, Quality Service plans will be 
developed and implemented for all ministries. 

Under the second initiative, all ministries are 
required to develop plans for implementing Common 
Service Standards for telephone calls, walk-in business, 
mail responses, and feedback/complaint resolution. 


We applaud the government for its work in this area. 


We are committed to continuously improving our programs 
in order to deliver Quality Service to our clients, and we look 
forward to working with the Ontario government to ensure 
that freedom of information is a key component of the OPS 
Quality Service Framework. 


Quality Service is also a top priority at the IPC, and 
we are committed to meeting or exceeding whatever 
service standards are set for the OPS. In addition, our 
Tribunal Service Department has adopted the following 
statement as one of the five corporate values guiding 
our actions, services, decisions and work relation- 
ships: “Striving for excellence in quality of work and 
delivery of services.” We respond promptly to our 
clients and are committed to timely and efficient file 


processing standards. 


Performance Measures 


We have also developed performance measures for our 
appeals and privacy complaint programs to ensure that 
quality service is in fact being provided. Access to infor- 
mation is a time-sensitive issue, and the oft-quoted 
phrase, “access delayed is access denied,” is absolutely 
true in many cases. Timely responses to access 
requests and appeals are an important component of 
any freedom of information scheme. In Ontario, insti- 
tutions are required by law to respond to requests 
within 30 days, or to extend this time limit with prop- 
er notice to requesters, together with a right of appeal. 
Requesters are also limited by law to a 30-day period to 
appeal any access decision to the IPC. In short, one 
important component of “Quality Service” in the con- 
text of an access request is adhering to the response 
times laid out in the statute. 

The Ontario government says that “all correspon- 
dence will be answered within 15 working days” in order 
to meet the Quality Service standard for the handling of 
mail. We support that. In light of this, surely there can 
be no dispute that the 30-day statutory response time 
for an access request must also be met as part of any 


“Quality Service Framework.” 


Standard not met = 


Unfortunately, many provincial ministries and agencies | Access to information is a time-sensitive issue, and the 
frequently do not meet the 30-day response standard. oft-quoted phrase, “access delayed is access denied,” is 
Over the past three years, less than 50% of access  absolutely true in many cases. Timely responses to access 
requests to provincial institutions were answered with | requests and appeals are an important component of any 
in 30 days. This compares to a figure of more than 80% freedom of information scheme. 


for municipal institutions. To be clear, not all provincial 
institutions are delinquent. The Ministry of Labour is a 
good example. It consistently ranks among the top three 
ministries in terms of number of requests, yet manages 
to respond to more than 70% within 30 days. Other 
high-volume ministries do not do as well, and we will be 
working with them to try to find out why, and to obtain 
their commitment to better levels of Quality Service. 

There are a number of steps we think the Ontario 
government can take to ensure Quality Service under 
the freedom of information scheme. Our suggestions | 
are included in the Commissioner’s Recommendations. 

The IPC is changing and evolving in response to 
an ever-changing environment. We are committed to 
continuously improving our programs in order to 
deliver Quality Service to our clients, and we look for- 
ward to working with the Ontario government to 
ensure that freedom of information is a key compo- 
nent of the OPS Quality Service Framework. 
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Key Issues 


How Technology can protect Privacy 


The question always arises: Is technology a plus or minus for privacy? The answer is that it 


can be both. The way we communicate, the way we do business, the way we conduct all 


aspects of our lives is increasingly affected by technology. And, at every turn, it seems that 


new technologies must know more about us in order to work properly. There is no doubt we 


are firmly planted in the Information Age. What we now need to understand is how we can 


cope with a new set of rules. 


First look at how we communicate. Cellular phones, 
both digital and analog, are everywhere. The young, 
the old and everyone in between uses e-mail to “talk” 
to each other, both down the hall or on the other side 
of the world. One of the not so pleasant surprises 
when we first started communicating electronically 
was that others could “overhear” our conversations. 
People were warned that an e-mail was as private as 
a postcard and that an inexpensive scanner could 
intercept the most private of cell phone conversations. 
The public’s strong reactions to these invasions of 
privacy shows why technology developers need to 
address privacy concerns as they create new tools for 
our use. Technology developers tend to first think 
about how to process information. We need them to 
also think about how to protect it - and many are now 
beginning to do just that. 

Encryption is the primary way to protect commu- 
nications privacy. Digital PCS (personal communica- 
tions services) phone systems have greatly improved 
the privacy of remote phone conversations because of 
their encryption facilities. In fact, it was interesting to 
note that encrypted transmission was a feature that 
was prominently displayed in the promotional materi- 
als for the new phone systems which became available 
in the past year. Encryption is also prominent in e-mail 
communications. Pretty Good Privacy (PGP) has for 
some time allowed people to use strong encryption 
keys to safeguard the text of their e-mails and their 
e-mail attached files. Increasingly, encryption is being 


incorporated into standard e-mail systems as the 


industry continues to move closer to a standardized 
communication protocol. Soon the somewhat cum- 
bersome process of encrypting each message and each 
file will be completely replaced by a seamless process 
handled by the e-mail system. 

Electronic commerce is one of the key areas 
where both privacy and security concerns must be 
addressed. Consumers have been cautious about 
buying over the Web because of these concerns and 
a number of initiatives have been undertaken to 
improve consumer confidence. 

Several technologies are being aimed at Web secu- 
rity and privacy problems. The main browser providers, 
Netscape and Microsoft, have built the “Secure Socket 
Layer” protocol (SSL) into their products. This allows 
for secure transfer of sensitive data such as credit card 
numbers. Developments in the use of digital signa- 
tures have also occurred in the past year. The purpose 
of a digital signature, just like a written signature, is to 
authenticate the identity of an individual. In the case of 
a digital signature, a digital code provides this assur- 
ance. In Germany, legislation has been passed to legit- 
imize the use of digital signatures, and “trust centres” 
are being established to certify digital signatures. In 
Canada, legislation has been introduced federally that 
will enable digital signatures to be used to do business 
electronically with federal institutions. 

The idea of a digital wallet expands on the digital 
signature concept. A digital wallet normally resides on 
a personal computer and holds more than just the 


digital signature. It also holds other information, such 


as shipping information, which is needed to conduct a 
payment transaction and which can be automatically 
inputted to a merchant. The protocol “Secure Electronic 
Transactions” (SET) is one example. Use of SET has not 
expanded as quickly as anticipated largely because of 
concerns about: the privacy of transaction-generated 
information, its use by merchants beyond simply fulfill- 
ing the specific transaction, and the security issues of 
storing sensitive information in the wallet. 

One attempt to address these concerns has been 
the development of a privacy standard by the World 
Wide Web Consortium through its Platform for 
Privacy Preferences project (P3P). The IPC is a partici- 
pant in the project as one of the invited experts asked to 
contribute non-technical, policy expertise. The specifi- 
cations developed in this project would give Web users 
the ability to make informed decisions about the use 
of their information and maintain their control over 
its use. It would give Web site operators the ability to 
make statements about their privacy practices, thus 
increasing user confidence. The specification is enter- 
ing the approval stage but is delayed as attempts are 
being made to patent certain aspects of it. 

The concept of a digital wallet is not restricted to 
personal computers. The cards we all carry in our wal- 
lets are advancing towards becoming digital wallets. 
Technologies are developing rapidly and the challenge 
is to ensure that privacy is not only preserved, but 
enhanced. Unlike credit and debit cards, the smart 
and stored value cards that will come in the future will 
contain considerable information. If those cards are 
developed with privacy in mind, our current level of 
privacy will be enhanced. Stored value cards or capac- 
itive cards can operate as anonymously as cash. And 
smart cards can have the information on them segre- 
gated into different partitioned areas of the card so 
that appropriate access and security measures can be 
set for each area. For areas holding the most sensitive 
information, a biometric technology such as voice 
recognition, finger scanning, facial recognition, or iris 


scanning could be used. 
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One developing technology area which will facili- 
tate the merger of communications and business 
activities is Intelligent Software Agent Technologies 
(ISATs). ISATs are software programs that act on your 
behalf to complete tasks without direct input or super- 
vision. Early versions of these agents, although not 
particularly intelligent, can now perform routine tasks. 
Rules or filters for handling e-mails are one example. 
The “push” agents which scour news sources and send 
requested information to us is another example. 

As the technologies develop, the agents will need 
a decreasing amount of input as they “learn” their 
user’s preferences. They will function more like an 
executive assistant than like software as we know it 
today. Just as any executive assistant knows an incred- 
ible amount of information about his or her boss, and 
just as discretion in an executive assistant is key, 
ISATs will store information about us while guarding 
our privacy jealously. 

To help ensure that ISATs maintain our privacy 
and trust, the IPC has joined once again with the 
Dutch Data Protection Authority in sponsoring a 
paper. Intelligent Software Agents: Turning a Privacy 
Threat into a Privacy Protector acknowledges that intelli- 
gent software agents have the potential to provide a 
valuable, much-needed service in the future. However, 
it emphasizes that by recognizing the threat to privacy 
this technology could represent, and by building priva- 
cy into the initial design, those responsible for creating 
these agents will maximize their ability to serve us. 

The ISATs paper, released in the spring of 1999, is 
only one example of how the IPC is keeping pace with 
the latest technological developments. The IPC meets 
regularly with companies on the leading edges of tech- 
nology to stay informed and to raise the awareness of 
these companies regarding access and privacy issues. 
To that end, a new program was launched wherein the 
IPC would meet on a monthly basis with leading-edge 


developers of privacy-enhancing technologies. 


—DS> | 


Key Issues 


Deference to the IPC 


In a 1998 decision involving the Workers’ Compensation Board (WCB), the Ontario Court of 


Appeal sent out an important message about the deferential treatment which it expects lower 


courts to show when reviewing decisions made by Ontario’s Information and Privacy 


Commissioner dealing with the exemptions from disclosure set out in the provincial and 


municipal Freedom of Information and Protection of Privacy Acts. 


In the WCB case, a consultant had sought access to the 
names and addresses of companies required to pay 
higher workers’ compensation assessments because of 
poor accident records, along with the actual surcharge 
amounts in some cases. The Workers’ Compensation 
Board denied access to the records pursuant to section 
17(1) of the provincial Act. This exemption requires an 
institution to refuse to grant access to trade secrets and 
scientific, technical, financial, commercial or labour 
relations information supplied to it in confidence by a 
third party where disclosure could reasonably be expect- 
ed to harm the third party’s commercial or competitive 
interests. 

The Commissioner overturned this decision and 
ordered the WCB to disclose the information on the 
basis that none of the records qualified under the 
exemptions. On an application for judicial review 
brought by the WCB, the Divisional Court found that 
the Commissioner’s decision was “patently unreason- 
able” on several grounds, and quashed the order. 

In a decision released on September 3, 1998, the 
Ontario Court of Appeal overturned the Divisional 
Court’s decision.The Court of Appeal concluded that, 
in determining whether records fall within the exemp- 
tions, the Commissioner is applying her expertise in 
balancing the need for access to information and the 
right to protection of confidentiality. Since the legisla- 
ture intended that the Commissioner should decide 
whether the exemptions applied, and that she should 
perform the role of fact-finding and weighing the con- 
tents of submissions, the Commissioner’s decisions 


need not be “correct” in the sense that the Court would 


necessarily agree with them, as long as they are not 
“unreasonable.” Judges should therefore accord “con- 
siderable deference” to the Commissioner’s decisions 
on whether or not the exemptions are available. 

In this particular case, the Court of Appeal con- 
cluded that: (1) the Commissioner’s interpretation of 
the third party exemption was consistent with previous 
orders, previous court decisions and dictionary defini- 
tions; (2) that the Commissioner acted reasonably in 
finding that the requested information was generated 
by the WCB and would not reveal information supplied 
in confidence by employers; and (3) that the Com- 
missioner had acted appropriately in requiring the 
institution and the employers to produce “detailed and 
convincing” evidence that harm could reasonably be 
expected to flow from disclosure of the records, which 
they had failed to do in this case. By substituting its 
own view of the interpretation and application of the 
statute and the evidence for the Commissioner’s 
“detailed, reasoned and logical” decision, the Divisional 
Court applied a wrong “correctness” standard of review 
when it should have deferred to the Commissioner. 

The strong message sent in the WCB case is that 
the Commissioner’s decisions on the application of the 
exemptions should not be interfered with by the courts 
unless it can be shown that the Commissioner has acted 
unreasonably. The Court of Appeal’s decision is a wel- 
come one as it settles contradictory court judgments on 
the standard of review of the Commissioner’s decisions 
and on the quality and cogency of evidence the 
Commissioner may require in deciding whether or not 


an institution has properly refused access to a record. 


Key Issues 


Access and Privacy Today 


New legislation and other steps taken by some government organizations are beginning to 


erode access and privacy rights in Ontario. 


The Freedom of Information and Protection of Privacy Act, 
which came into effect January 1, 1988, and the 
Municipal Freedom of Information and Protection of 
Privacy Act, effective January 1, 1991, established the 
basic rights of access to government-held information 
and the obligations imposed on provincial and munici- 
pal government organizations for the proper treatment 
of personal information in their custody and control. 
However, since that time, specific exclusionary 
provisions, the outsourcing and privatization of some 
government functions, and new legislation overriding 
aspects of freedom of information and protection of 
privacy legislation are impacting on access and privacy 


rights of Ontarians. 


Exclusions 


One primary concern of the IPC is legislation or 
programs that exclude information or records from 
the scope of the Acts. When this happens, access and 
privacy rights are compromised, and the right of 
review by an independent body, the IPC, is lost. 

One piece of legislation that excludes records 
from the Acts is the Labour Relations Act, 1995 (Bill 7). 
Its stated purpose is “to restore balance and stability to 
labour relations and to promote economic prosperity.” 
However, very broadly drafted provisions in the new 
law exclude many employment-related records about 
public sector employees, including records that do not 
have any bearing on labour relations. As a result, pub- 
lic sector employees may be precluded from obtaining 
access to employment-related records about them- 
selves, and from making a privacy complaint if their 
personal information is improperly used or disclosed. 
These new provisions have been interpreted in a num- 


ber of IPC orders, and records excluded from the Acts 


have been found to include the requester’s personnel 
file, records relating to the requester’s retirement, 
records about job competitions, and harassment 
investigation files, among others. 

This approach to information about employees is 
not in keeping with world-wide trends favouring fair 
information practices, and in particular, the protection 
of personal privacy. Examples of this trend include the 
privacy directive of the European Union, the adoption 
of Fair Information Practice Codes by many private 
sector enterprises, the recently adopted information 
and privacy laws in other Canadian provinces such as 
Alberta and Manitoba, the extension of privacy protec- 
tion legislation to the private sector in the Province of 
Quebec, and the recent introduction of Bill C-54, the 
Personal Information and Electronic Documents Act, by 
the federal government, extending the application of 
privacy laws to the privacy sector. 


Fees 


Another step that has had an impact on the number of 
Ontarians using access and privacy legislation was the 
introduction of an amended fee structure for access 
requests in 1996. 

The government has frequently stressed the 
importance of user-pay, a principle which has found 
wide acceptance among members of the public. This 
approach has been applied to the Acts as a result of 
changes brought about by the Savings and Restructuring 
Act, 1996 (Bill 26). A $5 fee for each access request is 
now required, including requests for a person’s own 
personal information, and appeal fees ($10 or $25, 
depending on the type of appeal) have also been 
imposed. The two hours of free search time was also 


eliminated as part of this new fee structure. 


These new fee provisions have had a dramatic 
impact on the public’s use of the Acts. From 1995 (the 
last year before the new fees were introduced) to 1998, 
the number of requests declined by 25% In the same 
period, appeals declined by 56%. 


The sheer size of the decrease in the number of requests 
and appeals compels us to question whether the new fees 
have gone too far, particularly the appeal filing fee. 


The IPC supports the user-pay principle, and 
observes that some reduction of requests and appeals 
may result from the elimination of questionable use of 
the Acts. As well, the IPC welcomes the increase in rou- 
tine disclosure by government organizations of fre- 
quently requested information — which has also been a 
factor in the reduction of requests. However, the 
removal of certain kinds of information from the scope 
of the Acts, under legislation such as the Labour 
Relations Act, 1995 has had an impact as well. The 
sheer size of the decrease in the number of requests 
and appeals compels us to question whether the new 
fees have gone too far, particularly the appeal filing fee. 
The right of access to government information is an 
important accountability mechanism, and it is unfortu- 
nate that use of this avenue appears to have declined, at 


least in part, as a result of the new fee structure. 
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Privatization and Alternate 
Service Delivery 


The transfer of government enterprises to the private 
sector or to other independent bodies is another way 
that access and privacy rights can be lost or reduced. 
For example, under the Energy Competition Act, 1998, 
Ontario Hydro has been divided into five separate cor- 
porations. Two of these, the Ontario Electricity 
Generation Corporation and the Ontario Electric 
Services Corporation, have not been scheduled as insti- 
tutions under either of the Acts, despite the fact that, in 
the past, all of Ontario Hydro has been covered. IPC 
Order P-1190, upheld by the Ontario Court of Appeal, 
illustrates why continued access to information in 
Ontario Hydro’s possession remains important. Based 
on a provision of the legislation that permits the IPC to 
do so where it is in the public interest, the IPC ordered 
disclosure of records which assessed the safety of 
several nuclear power plants in Ontario. 

The IPC met with representatives of Ontario 
Hydro and the Ministry of Energy, Science and 
Technology to discuss our concerns. The government 
has not agreed to make these new corporations subject 
to the Acts. 

The Safety and Consumer Statutes Administration 
Act, 1996, may also reduce access and privacy rights. 
This law provides for supervisory or inspection func- 
tions in a number of areas, including elevators, 
amusement rides and gasoline handling, by indepen- 
dent non-profit corporations. These particular func- 
tions were previously administered directly by the gov- 
ernment, and associated records, including inspection 
reports, were therefore accessible under the provincial 
Act. Now that the administration has been transferred 
to an independent corporation, this may no longer be 
the case. The important public safety issues have not 
changed, so why shouldn’t the public continue to have 
access to these records? Given that these corporations 


will also be collecting personal information, the 


preservation of privacy protection is also critically 
important. The IPC attempted to secure these rights 
when the legislation was passed, but without success. 


Protected Rights 


Not all the news about the impact of new legislation on 
access and privacy rights is worrisome, however. The 
Ministry of Community and Social Services, working 
closely with the IPC, incorporated extensive privacy 
safeguards into the Social Assistance Reform Act in 
1997. Among legislation enacted during 1998, the 
Highway 407 Act, 1998, and the Legal Aid Services Act, 
1998, are good examples of new laws where steps 
where taken to protect access or privacy rights. The 
IPC suggested amendments to the Highway 407 Act, 
1998, to ensure that the privacy of users of the elec- 
tronically monitored highway would be protected, and 
also suggested that the agreement transferring the 
highway should require the new owner to adhere to 
the spirit and intent of the provincial Act. These sug- 
gestions were agreed to and adopted by the govern- 
ment. The bill was amended in committee. 

The Legal Aid Services Act, 1998, makes funda- 
mental changes to the way that Legal Aid is delivered in 
Ontario. Formerly administered by the Law Society of 
Upper Canada, Legal Aid will now be run by a new cor- 
poration called Legal Aid Ontario. The IPC commented 
on several sections that covered the collection of per- 
sonal information from applicants for Legal Aid, and 
required lawyers to give client information to Legal Aid 
Ontario. Our suggestions were aimed at protecting per- 
sonal privacy as well as solicitor-client privilege. The 
vast majority of our recommendations were adopted, 
and, as a result, these important rights were enhanced 
for all Legal Aid applicants and recipients in Ontario. 


Looking Forward 


A number of recommendations by Commissioner 
Ann Cavoukian are included in the Commissioner’s 


Recommendations section, immediately following. 


, 


This approach to information about employees is not in keep- 
ing with global trends favouring fair information practices, | 
and in particular, the protection of personal privacy. 


Commissioner’s 
Recommendations 


If you use a debit or credit card, belong to a loyalty program or visit any Web sites, many of 


the issues reviewed in this annual report will have already touched your life. 


Concerns about privacy have risen exponentially as companies are discovering more and 


more ways to glean competitive advantages from increasingly larger databases of personal 


information, compiled from day-to-day transactions and communications. 


At the same time that information about individuals may be obtained more readily, 


Ontarians are discovering that their ability to access government records is being curtailed, 


either directly or as a byproduct of new legislation, the outsourcing of some programs to the 


private sector, and the level of resources being directed to provide answers to Ontarians. 


In response to these issues and concerns, I have outlined some specific recommenda- 


tions for the government to consider: 


(1) Privacy Legislation 


The impending federal privacy legislation (Bill C-54), 
which will protect privacy and safeguard personal infor- 
mation collected, used or disclosed in the private sector, 
is a major step forward. But there is a key decision that 
Ontario must make. When the federal Act comes into 
force, it will apply to all federally regulated businesses 
using or requiring personal information for commercial 
activities within more than one province. Three years 
after proclamation, the Act will apply to all provincially 
regulated businesses as well, unless the province has 
already enacted comparable legislation. While my office 
has had considerable input into the federal legislation, if 
Ontario fails to bring in a provincial counterpart, I fore- 
see needless confusion and inefficiency. For example, if 
Ontario does not act, jurisdiction for handling privacy 
complaints will be split between the Ontario Informa- 
tion and Privacy Commissioner, responsible for the 
provincial and municipal public sector, and the federal 
Privacy Commissioner, who would be responsible for 
the provincial private sector. This would create consider- 
able confusion as to who to turn to and which office to 
use, potentially weakening the impact of this very 
important legislation. 


+ I recommend that Ontario introduce privacy legis- 
lation covering the private sector, harmonized 
with Bill C-54. 


(2) Quality Service 


Quality Service standards are an important priority of 
the Ontario government, and include a commitment to 
respond to general correspondence within 15 working 
days. However, some Ontario ministries are consistent- 
ly failing to meet the legislated 30-day response stan- 
dard on access requests. To help Management Board 
Secretariat deliver the message that effective adminis- 
tration of Ontario’s freedom of information and privacy 
program is a key government commitment, and that 
meeting the legislated time frames for this important 


public program is a must, I recommend: 


+ Adding a commitment to meeting the 30-day 
response standard for access requests within the 
Quality Service framework and including this 
commitment as part of the performance contracts 
for Deputy Ministers and other senior govern- 
ment officials; 


+ Recognizing the critically important role played 
by Freedom of Information and Privacy Co-ordi- 
nators, through appropriate levels of delegated 
decision-making authority, and appropriate job 
classification as befits the nature and responsibil- 
ity of the position; 


+ Adequate resourcing of Co-ordinator’s offices to 
enable Quality Service for access and privacy to be 
consistently achieved. 


(3) Fees 


The Savings and Restructuring Act, 1996 (Bill 26) 
brought in new user fees. While the IPC supports the 
user- pay principle, the dramatic decrease in the num- 
ber of requests for information and appeals under- 


scores the need to review the fee structure. 


+ I recommend that the government review the fee 
structure and consider lowering the appeal fee to 
the same level as the request fee ($5). 


(4) Exclusions 


I am very concerned about legislation or programs that 
exclude information from the scope of the Freedom of 
Information and Protection of Privacy Act and the 
Municipal Freedom of Information and Protection of 
Privacy Act. When this happens, access and privacy 
rights are compromised, and the right of review by an 
independent body is lost. One Act in particular has had 
a very significant impact, namely the Labour Relations 
Act, 1995 (Bill 7). As has become abundantly clear 
through decisions of our agency, the scope of Bill 7 
goes far beyond its stated original intent. 


+ I recommend that the government review the 
implications of Bill 7, with the intent of narrowing 
the scope of its impact on the provincial and 


municipal Acts. 


(5) Closing doors 


Access and privacy rights can be lost when govern- 
ment enterprises are transferred to the private sector 
or to other independent bodies. Ontario Hydro is a 
prime example. Under the Energy Competition Act, 
1998, Ontario Hydro has been divided into five sepa- 
rate corporations, and the two largest segments — the 
Ontario Electricity Generation Corporation and the 
Ontario Electric Services Corporation — are not cov- 
ered under either of the Acts. I understand the con- 
cerns about creating a level playing field in a competi- 
tive energy sector, but Ontarians are losing access and 
privacy rights to the key segments of the successors to 
the largest utility in Canada — including the corpora- 
tion that will be running all of Ontario’s nuclear power 
plants. As Paul Webster astutely noted in a recent arti- 
cle in one of our leading newspapers, “By stating that 


commercial secrecy outweighs the public’s crucial 
interest in transparency and accountability, the gov- 
ernment denies an important public need.” I recom- 
mend that: 


+ the government review its decision to leave 
Hydro’s successor corporations outside the scope 
of the Acts; 


+ that the government formally implement a process 
involving ongoing consultation with the IPC on 
access and privacy matters, prior to finalizing pri- 


vatization or alternative delivery initiatives. 


Ontarians are discovering that their ability to access gov- 
ernment records is being curtailed, either directly or as a 
byproduct of new legislation, the outsourcing of some 
programs to the private sector, and the level of resources 
being directed to provide answers to the public. 
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Requests by the public 


Across Ontario, nearly 20,000 requests for informa- 
tion were made under the Acts in 1998. 

Provincial government organizations received 
9,353 requests for information, 70 more than the pre- 
vious year’s 9,283. Municipal government organiza- 
tions received 10,598 requests in 1998, compared to 
11,295 in 1997. 

Provincial and municipal government organiza- 
tions file a yearly report to the IPC on their activities 
under the Acts. These reports include data on the 
requests received for general records, personal infor- 
mation, and correction of information, as well as the 
response by these organizations to the requests. By 
compiling these reports, the IPC gains a useful picture 
of compliance with the Acts. 

Requests for access to general records in 1998 
outnumbered requests for access to personal informa- 
tion by nearly three to one. The proportions differed 
significantly for provincial and municipal organiza- 
tions, with general records requests outnumbering 
personal information requests by slightly under four 
to one for provincial organizations and by slightly 
more than two to one for municipal organizations. 

The majority of requests received by both the 
provincial and municipal organizations were completed 
by year-end. Only slightly more than 12% of requests 
were carried over to 1999. 

Once again, the Ministry of Environment and 
Energy reported the highest number of requests 
received under the provincial Act, followed by the 
Ministry of Solicitor General and Correctional Services, 
the Ministry of Labour and the Ministry of Health. 
Together, these four Ministries accounted for 76% of 
all provincial requests. 

Police services boards received slightly more 
than half (51%) of the total requests filed under the 
municipal Act. Municipal corporations (including 
municipal governments) were next with 37%, followed 
by public utilities with six per cent and school boards 
with almost three per cent. 


REQUESTS RECEIVED AND COMPLETED - 1998 
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Overall, 42% of provincial requests were 
answered within 30 days in 1998. In all, 74% of 
provincial requests were completed within 6o days, 
while just over nine per cent took more than 120 days. 
In 1997, less than six per cent of provincial requests 
took more than 120 days to complete. 

Municipal government organizations responded to 
84% of requests within 30 days in 1998, twice as many 
— on a percentage basis — as their provincial counter- 
parts. Municipal government organizations have topped 
the 80% mark for requests responded to within 30 days 
every year since the Municipal Freedom of Information 
and Protection of Privacy Act came into effect on Jan. 1, 
1991. Overall, 96% of municipal requests in 1998 were 
answered within 6o days, while less than one per cent 
took more than 120 days to complete. 

As to outcomes, 30% of provincial requests com- 
pleted in 1998 led to the release of all information 
sought. Another 18.4% were disclosed in part. For 
municipal requests, 48.5% of requests led to full disclo- 
sure and another 30.6% were disclosed in part. Overall, 


no information was released in one in four cases. 


Under the exemption provisions of the Acts, 
government organizations can, and in some cases 
must, refuse to disclose requested information. In 
past years, both provincial and municipal organiza- 
tions cited personal privacy and personal information 
exemptions most frequently. This pattern did not 
change in 1998. 

Under the legislation, individuals have the right 
to request correction of their personal information 
held by government. In 1998, provincial organizations 
received four requests for corrections and refused one. 
Municipal organizations received 377 correction 
requests and refused six. When a correction is refused, 
the requester may attach a statement of disagreement 
to the record, outlining why he or she believes the 
information is incorrect. This year, one provincial and 
four municipal statements of disagreement were filed. 

In addition to application fees, the legislation 
permits government organizations to charge additional 
fees under certain conditions. Where the expected 
charge is over $25, a fee estimate must be provided 
before work begins. Government organizations have 
the discretion to waive payment where it seems fair and 
equitable to do so after weighing several specific factors. 

For 1998, provincial institutions reported collecting 
$44,420 in application fees and $274,461 in additional 
fees. Municipal institutions reported receiving $55,737 
in application fees and $69,710 in additional fees. 

Provincial organizations most often cited search 
time as the reason for collecting fees. Search time 
costs were mentioned in 51% of cases where fees were 
collected, followed by reproduction costs in 25% and 
shipping costs in 11%. Municipal organizations cited 
reproduction costs in 70.9% of cases, search time in 


19.1% and preparation in 5.9%. 


Across Ontario, nearly 20,000 requests for information 
were made under the Acts in 1998. 


OUTCOME OF PROVINCIAL REQUESTS - 1998 
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PROVINCIAL EXEMPTIONS USED 
GENERAL RECORDS — 1998 


Other — 385 (20.3) 
Section 17 — Third Party Information 188 (9.9) 
Section 14 — Law Enforcement 371 (19.6) 


Section 21 — Personal Privacy 950 (50.2) 


MUNICIPAL EXEMPTIONS USED 
GENERAL RECORDS -— 1998 


Other — 364 (11.4) 
Section 10 — Third Party Information 120 (3.7) 
Section 8 — Law Enforcement 804 (25.2) 


Section 14 — Personal Privacy 1905 (59.7) 


PROVINCIAL EXEMPTIONS USED 
PERSONAL INFORMATION — 1998 


Other — 68 (9.6) 


Section 14 — Law Enforcement 69 (9.7) 


Section 17 — Third Party Information 120 (16.9) 


Section 49 — Personal Information 454 (63.8) 


MUNICIPAL EXEMPTIONS USED 
PERSONAL INFORMATION — 1998 


Other — 227 (9.5) 


Section 14 — Personal Privacy 508 (21.2) 
Section 38 — Personal Information 970 (40.4) 


Section 8 — Law Enforcement 693 (28.9) 


CASES IN WHICH FEES WERE ESTIMATED -— 1998 


Provincial Municipal 
Collected in Full 92.2% 4818 42.6% 1135 
Waived in Part 1.4% 72 16.1% 428 
Waived in Full 6.4% 337 41.3% 1100 
Total Application Fees Collected $44,420 i $55,737 
Total Additional Fees Collected $274,461 $69,710 
Total Fees Waived $5,184 $17,743 
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Appeals by the public 


The right to appeal to an independent body — the IPC 
— is one of the foundations of access and privacy 
legislation in Ontario. 

Anyone who has made a request under the 
legislation to a provincial or municipal government 
organization and who is not satisfied with the response 
can appeal the decision to the IPC. Appeals can be filed 
concerning a refusal to provide access to general 
records or personal information, a refusal to correct 
personal information, the amount of fees charged, or 
other procedural aspects relating to a request. 

When an appeal is received, the IPC first attempts 
to settle the appeal informally. If all the issues in an 
appeal are not resolved within a reasonable period of 
time, the IPC may conduct an inquiry and issue a 
binding order, which could include ordering the 
government organization to release all or part of the 


information sought. 


Enhancing the Process 


During 1998, the IPC’s Tribunal Services Department 
focused on the implementation of the first phase of 
a comprehensive program of process changes and 
continuous improvement. The program resulted from 
a comprehensive review of the Tribunal’s two program 
areas — access to information appeals and privacy 
complaint investigations. The review was initiated in 
the latter part of 1997. 

On May 1, 1998, the department implemented a 
number of changes that emerged from this review, 


among them: 


« creation of an expanded Registrar function and 
new intake function to screen files and stream 
cases to the most effective and appropriate process, 


based on past experience; 


* a renewed commitment to mediation as the pre- 


ferred method of resolving appeals and complaints; 


dedicated provincial and municipal mediation 
teams, to enable the IPC to develop higher levels 


of internal knowledge and expertise; and 


+ an Institutional Relations Program for both 
provincial and municipal clients, recognizing that 
we can serve our clients more effectively if we can 
better understand them and tailor our relationship 


accordingly. 


In 1999, we are focusing on the implementation 
of the second phase of changes, which relate to the 
inquiry stage of the appeal process. In particular, we 
will be implementing a new method by which repre- 
sentations are submitted to the IPC and are shared by 
the parties in the inquiry process. 


Statistical Trends 


In all, 669 appeals were made to the IPC in 1998, 
down six per cent from the previous year. There were 
334 appeals lodged under the provincial Act and 335 
appeals filed under the municipal Act. In all previous 
years, except 1995, the number of provincial appeals 


exceeded the number of municipal appeals. 
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Provincial appeals were down nine per cent from 1997. 
Eighty-four per cent of provincial appeals involved min- 
istries rather than agencies. This proportion is similar 
to that of previous years. 

Municipal appeals were down two per cent in 
1998. The largest proportion of appeals — 44% — con- 
cerned the police, followed by municipal corporations 
and then boards of education. This is the first year in 
which the number of appeals involving the police 
exceeded the number of appeals involving municipal 
corporations. 

About one-third of all appeals involved a request 
for personal information, while about 27% concerned 
a request for general records. About 31% involved a 
request for both general records and personal infor- 
mation. As was the case in previous years, there were 
few appeals in other categories such as fee estimates 
and objections by third parties to the disclosure of 
information. 
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Appeals Closed 


The IPC closed 640 appeals during 1998 — a decrease 
of 14% from 1997. As was the case in previous years, 
slightly more than half (333) of those resolved in 1998 
concerned provincial government organizations. 
Forty-eight percent (307) of the appeals closed con- 
cerned municipal institutions. Municipal appeals 
closed were down 16%, while provincial appeals closed 
were down 13% in comparison to 1997 levels. 

Consistent with our renewed emphasis on medi- 
ation, the majority of appeals — 58% — were closed 
without the issuance of a formal order. Of the appeals 
closed by means other than an order, 70% were suc- 
cessfully mediated, 25% were withdrawn and three per 
cent were abandoned. An additional two per cent of 
appeals were dismissed without an inquiry. 

Forty-two per cent of the cases closed in 1998 
were resolved by issuing an order. The number of 
appeals closed by order was down 31%, and the relative 
proportion of appeals closed by order was down nine 
per cent from 1997. In 1998, 44% of provincial and 
39% of municipal appeals were closed by order. 

The IPC issued 260 orders during 1998 — a 28% 
decrease from the previous year. (The number of 
orders is less than the number of appeals closed by 
order, since an order may deal with more than one 
appeal.) Of these 1998 orders, 53% concerned provin- 
cial government organizations. 

In appeals resolved by order, the decision of the 
head of the government organization involved was 
more likely to be fully upheld than partly upheld or not 
upheld. The decision of the head was fully upheld in 
about 48% of orders — down from 1997 when 58% of 
orders fully upheld the decision of the head. 


OUTCOME OF APPEALS CLOSED BY ORDER 
PROVINCIAL — 1998 


Other 9 (6.2%) 


Head's Decision Not Upheld 11 (7.6% 
Head’s Decision Partly Upheld 61 (42.1% 


Head’s Decision Upheld 64 (44.1%) 


OUTCOME OF APPEALS CLOSED BY ORDER 
MUNICIPAL — 1998 


Other 10 (8.3%) 


Head's Decision Not Upheld 9 (7.4%) 
Head's Decision Partly Upheld 38 (31.4%) 


Head’s Decision Upheld 64 (52.9%) 


OUTCOME OF APPEALS CLOSED OTHER THAN BY ORDER 
PROVINCIAL — 1998 


Other 1 (0.5%) 


No Inquiry 3 (1.6%) 


Abandoned 5 (2.7%) 


Withdrawn 49 (26.1%) 


Successfully Mediated 130 (69.1%) 


OUTCOME OF APPEALS CLOSED OTHER THAN BY ORDER 
MUNICIPAL — 1998 


Other 1 (0.5%) 


No Inquiry 3 (1.6%) 


Abandoned 7 (3.8%) 


Withdrawn 44 (23.7%) 
Successfully Mediated 131 (70.4%) 


Reconsiderations 


While the decisions made by the IPC after an inquiry 
are final and not subject to appeal, under certain lim- 
ited circumstances, the IPC may reconsider a decision. 
During 1997, the IPC received 37 requests to recon- 
sider decisions. Thirty-six reconsideration requests 
were dealt with during the year. This number includes 
four requests that were received in 1997. 

Of the 36 cases that were completed in 1998, 26 
of the requests were declined on the basis that insuffi- 
cient grounds for the reconsideration had been raised. 
Of the 10 reconsideration requests that met the criteria 
for reconsideration, three resulted in no change to the 
original order, one resulted in the original order being 
changed in part, five resulted in changes to the original 
order, and one was dismissed after reconsideration. 
Five of the requests for reconsideration received in 1998 
were still pending or on hold at the end of the year. 


IPC APPEALS APPLICATION FEES COLLECTED — 1998 


$7,204 
$1,824 
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Judicial Reviews 


A diverse cross-section of Ontario residents utilize 
the rights provided under freedom of information 
legislation — including the right to appeal to the IPC 
a decision by a government organization to reject a 
specific access request. 

In contrast, judicial review applications — seeking 
leave to have IPC orders reviewed — are more likely to 
be brought by provincial or municipal organizations 
rather than by members of the public. 

Seven of the nine judicial files which were closed 
in 1998 had been opened by government institutions 
disputing an IPC order through the courts. 

Of these nine cases, seven of the applications 
were abandoned, with the result that the IPC’s orders 
stand. In the remaining two cases, IPC orders were 
upheld by the courts. The government records at the 
heart of the nine judicial review files that were closed 
in 1998 cover a wide range of subjects. The records 
include a microfilm listing of registered trade names; 
a Ministry inspection report concerning a Canadian 
private school in France; law enforcement records; 
records relating to a land claim; documents pertaining 
to a workers’ compensation recipient, and records 
connected to the investigation of a sexual harassment 


complaint made by an employee against her employer. 


Of these nine cases, seven of the applications were aban- 
doned, with the result that the IPC’s orders stand. In the 
remaining two cases, IPC orders were upheld by the courts. 


| 


OUTSTANDING JUDICIAL REVIEWS 
AS OF DECEMBER 31, 1998: 24 


Launched by: 


Requesters 7 


Affected parties 2 


Institutions 15 


New applications received in 1998: 15 


JUDICIAL REVIEWS CLOSED IN 1998: 9 


Of these: 


Abandoned (IPC order stands): 7 


IPC order upheld: 2* 


* Orders upheld: M-845; P-373 


As is the case with the nine files which were 
closed last year, a review of the 15 new judicial review 
applications initiated in 1998 quickly reveal that 
provincial and municipal institutions rather than 
individual requesters are more likely to dispute the 
IPC’s orders in the courts. Ten of the 15 new applicants 
for judicial review were government institutions. 

As with the nine files which were closed, the docu- 
ments that became the subject of new judicial review 
proceedings cover a diverse range of information held 
by a wide variety of government institutions. Most of 
the records in these 15 cases fall into two general cate- 
gories. The first is employment-related documents 
and includes performance appraisals and documents 
pertaining to job competitions. The second is law 
enforcement investigations and includes information in 
regard to allegations of police misconduct; the contents 
of a public complaint file; and documents gathered by 


the police in the course of criminal investigations. 


The judicial review process is part of the checks and 
balances under freedom of information legislation. 
Decisions made in the appeals process are final and 
not subject to appeal. However, in certain limited 
circumstances, the courts may review how a decision 
was made and determine whether it was within the 
IPC’s jurisdiction. 

A tribunal’s “jurisdiction” is the set of powers 
given to it by the Legislature together with certain 
principles of fair procedure developed by the courts. 
To be within a tribunal’s jurisdiction, a decision must 
be one that the tribunal has legal authority to make 
and the decision must be made using procedures that 
treat all parties fairly. 

In reviewing a tribunal’s decisions, a court will 
consider whether a tribunal is acting within its pow- 
ers, in accordance with the law, and with fairness, rea- 
sonableness, and impartiality. 

A court that receives an application for judicial 


review may: 


¢ order the tribunal to take an action that the law 


requires it to take; 


¢ order the tribunal not to do something that is 
prohibited by law; 


. strike down an order that was not arrived at 


properly; or 


declare the conduct of the tribunal to be contrary 


to the law. 
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Privacy Investigations 


To help protect personal privacy, the Freedom of 
Information and Protection of Privacy Act and the 
Municipal Freedom of Information and Protection of 
Privacy Act establish rules for the collection, retention, 
use, disclosure, security, and disposal of personal 
information held by government organizations. 

Anyone who believes that a provincial or munici- 
pal government organization has failed to comply 
with one of the Acts — and that his or her privacy has 
been compromised as a result - may complain to the 
Information and Privacy Commissioner. The IPC inves- 
tigates the complaint, attempts to mediate a solution, 
and, depending on the findings of the investigation, 
may make formal recommendations to the organization 
to amend its practices. 

To help ensure adherence to the legislation, the 
IPC also conducts compliance reviews of selected 
organizations’ information management practices. In 
addition, the IPC comments on the privacy aspects of 
any computer-matching proposals made by govern- 


ment organizations. 


New System in Place 


The way the IPC receives and processes privacy 
complaints underwent a change in 1998 as part of a 
comprehensive series of process changes within the 
Tribunal Services Department aimed at providing an 
even more responsive and efficient service. On May 1, 
1998, a new Intake Unit was created. When privacy 
complaints are received by telephone, in writing or in 
person, they are directed to a Case Review Analyst. 
Efforts are made to resolve the matter informally at the 
Intake stage. If a more detailed investigation is 
required, it is handled on a more formal basis through 
either the municipal or provincial mediation teams. 

In many cases, what previously was handled as a 
formal privacy complaint is now resolved informally at 
the Intake stage. 


More Calls 


As well as investigating privacy complaints, the IPC 
also responds to more general privacy questions or 
concerns received by telephone or in person. In 1998, 
615 oral queries about privacy were received, an 


increase of 103 from 1997. 


Probing Complaints 


The IPC launched 104 privacy investigations in 
1998. Ninety-six investigations were completed 
during the year. 

Seventy-three per cent of the complaints resolved 
in 1998 involved the disclosure of personal informa- 
tion, while 16% related to the collection of personal 
information. An additional five per cent of the com- 
plaints involved general privacy issues. 

Of the 96 complaints resolved in 1998, 19% 
involved a breach of the Acts. Of the 188 cases resolved 
in 1997, only 10.7% involved a breach of the Acts. 

As was the case in previous years, the general 
public was the principle user of the complaints system. 
Of the cases completed in 1998, 88% were complaints 
filed by the general public. Five per cent were filed by 
employees of institutions. 

In looking into complaints, the IPC continues to 
emphasize informal resolution. About 61% of the 
complaints resolved in 1998 were settled informally. 
An additional 33% were withdrawn or abandoned. 

Five formal investigation reports were issued in 
1998, resulting in seven recommendations to govern- 
ment organizations. In addition, the IPC followed up 
on recommendations that had been made in previous 
years and found that all had been implemented to the 
IPC’s satisfaction. 


NUMBER OF PRIVACY INVESTIGATIONS COMPLETED 
1989-1998 
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PRIVACY INVESTIGATIONS COMPLETED 
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PRIVACY INVESTIGATIONS COMPLETED BY ISSUE 
PROVINCIAL — 1998 


General Privacy — 2 (4.8%) 


Personal Information — 1 (2.4%) 


Retention/Disposal — 2 (4.8%) 
Collection — 7 (16.7%) 
Disclosure — 30 (71.4%) 


TYPES OF COMPLAINANTS INVOLVED IN 
PRIVACY INVESTIGATIONS 
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PRIVACY INVESTIGATIONS COMPLETED BY ISSUE 
MUNICIPAL — 1998 


General Privacy — 3 (5.6%) 


Personal Information — 2 (3.7%) 
Notice of Collection — 1 (1.9%) 
Collection — 8 (14.8%) 
Disclosure — 40 (74.1%) 


SUMMARY OF PRIVACY INVESTIGATIONS - 1998 


1997 Privacy 1997 Total 1998 Privacy 1998 Total 

Complaints Complaints 

(Provincial) (Municipal) (Provincial) (Municipal) 
Carried Forward 26 10 36 8 10 18 
Initiated 104 66 170 46 58 104 
Completed 122 66 188 42 54 96 
In Process 8 10 18 12 14 26 
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Information about 
the IPC 


Outreach program 


The IPC has a vibrant outreach program to help meet its mandate to educate the public 


about Ontario’s access and privacy laws and increase the public’s awareness of access and 


privacy issues. 


The four key components of the outreach program 
include: 

« the public speaking program; 

+ the media relations program; 


+ the publications program (print and electronic); 


+ the IPC’s Web site. 


Public Speaking 


Commissioner Ann Cavoukian is a much sought-after 
speaker, with requests coming from across Canada, 
the United States, and internationally. She made 
numerous presentations in 1998, including speaking 
to senior executives at four of Canada’s five largest 
banks on privacy issues. Other presentations included 


speeches to: 
+ major technological conferences; 


* various groups at the University of Toronto and 
the University of Waterloo; 


+ Privacy and American Business’s annual 
Managing the Privacy Revolution conference in 
Washington, D.C.; 


+ Management Board’s annual Freedom of 


Information and Protection of Privacy conference; 


+ an extensive list of other diverse organizations. 


OTHER ASPECTS OF THE IPC’S GROWING PUBLIC 
SPEAKING PROGRAM INCLUDE: 


a school speakers program, under which mem- 
bers of the Tribunal Services Department make 
presentations to high school and elementary 
classes. The program, Ask an Expert, is aimed at 
Grades 5 and 10. These two grades were carefully 
chosen because this is when the concepts of gov- 
ernment and civics are introduced in the class- 
room. We feel it is important that children begin 
to learn about the values of open government and 
privacy protection in the context of other related 


and relevant studies; 


a journalism students program, under which the 
IPC’s media relations officer speaks to college 


and university journalism classes; 


a university technology speakers program, where 
senior IPC staff speak to technology classes at 


Ontario universities; 


a general public speaking program, under which 
staff members from various departments speak 
to groups or organizations that have ranged from 
CNIB executive assistants to school board staff. 


Media Relations 


Media stories are one of the ways that Ontario residents 
learn about access and privacy issues. The IPC has both 
a pro-active and reactive media relations program. The 
Commissioner is the official spokesperson for the IPC 
and accepts as many media requests for interviews as 
her schedule allows. The IPC also actively approaches 
the media for coverage when major IPC policy papers 
are released. 

During 1998, the Commissioner gave 68 media 
interviews — to national print, TV and radio reporters, 


Ontario media, and international media. 


IPC Publications 


The IPC released 12 publications in 1998 while 
updating and re-releasing 29 core Practices. The publi- 
cations included the first two in a new series — If you 
wanted to know... — which focuses on recent issues of 
significant public interest. (See the following page for 


more information.) 


IPC Web site 


This site is another cornerstone of the outreach 
program as it makes all IPC publications, copies of 
the legislation the IPC operates under, and common 
questions and answers, readily available to anyone 
who has access to the Web. (Others can call the IPC’s 
Communications Department and ask for copies to be 
mailed or e-mailed.) For more information on what 


you can find on the IPC’s Web site and for research 


tips, see the following pages. 
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Publications/Web site 


One of the key avenues the IPC uses to help fulfill its legislative mandate to increase public 
awareness of access and privacy issues is its publishing program. Each year, the IPC pub- 


lishes a number of policy papers and specialty publications. 


Papers published in 1998 included: the rights of students and their parents to obtain 


students’ personal information from schools and 


+ Data Mining: Staking a Claim on Your Privacy. The how ‘the: Mon pe 


report looks at a growing practice that businesses 
are using to cull more information about clients 
or potential clients from giant data bases. Without 
proper safeguards, data mining can jeopardize 
informational privacy. The report lists choices that 
consumers and businesses may want to consider 


in order to enhance personal privacy. 


Privacy: The Key to Electronic Commerce. The report 
provides a timely overview of privacy issues in the 
context of the much-hyped electronic commerce, 


and offers some possible solutions. 


The Internet: A Guide for Ontario Government Orga- 
nizations. This report, produced in collaboration 
with Management Board Secretariat, provides 
provincial and municipal Freedom of Information 
and Privacy Co-ordinators with an overview of 
why the Internet will be an essential component 


of any access and privacy program. 


407 Express Toll Route: How You Can Travel this 
Road Anonymously. A collaborative effort between 
the IPC and the Ontario Transportation Capital 
Corporation, it outlines the “anonymous account 
billing system” that was developed to address pri- 
vacy concerns regarding an electronic surveillance 


system being used for billing purposes. 


A Guide to Ontario Legislation covering the release 
of Students’ Personal Information. Presented in a 


question and answer format, the report reviews 


Protection of Privacy Act and the Education Act apply. 

Among other releases, the IPC updated and 
re-released its 29 core Practices, which cover a 
wide range of access and privacy topics, including 
Routine Disclosure/Active Dissemination (RD/AD) of 
Government Information and Video Surveillance: The 
Privacy Implications. 

Other 1998 publications included the IPC’s 
1997 annual report, two editions of the IPC 
newsletter, Perspectives, and two editions of the 
Subject Index. 

As well, the IPC released the first two publi- 
cations in a new series, If you wanted to know..., 
which examines topical issues, many of them 


related to the Internet. These included: 


« How to fight Spam, which looks at the growing 
problem of unsolicited e-mail and explains how 


you can reduce the flow. 


+ What to do about Cookies, which explains what 
a “cookie” is and how Web users can reduce the 


electronic tracks they leave behind on the Internet. 


Readily available 


All of these 1998 reports and many earlier IPC papers 
are available on the IPC Web site (www.ipc.on.ca). Or, 
you can call the Communications Department at 416- 
326-3333 or 1-800-387-0073 and ask to have the reports 


you are interested in mailed or e-mailed to you. 


Among the many other IPC reports available 
are: Identity Theft: Who's Using Your Name? (1997); 
A Model Access and Privacy Agreement (1997), which 
includes a template designed for insertion into con- 
tracts drawn up when a government function is trans- 
ferred to the private sector; and Privacy-Enhancing 
Technologies: The Path to Anonymity (1995). 

If you would like to receive IPC publications on 
a regular basis via e-mail, just ask to be placed on 
our electronic mailing list by sending an e-mail to 
publicat@ipc.on.ca with your name, address, phone 
number, and the e-mail address to which you want 


the publications sent. 


Web site 


Readers interested in discovering more about access 
to information or privacy issues are invited to visit 
the IPC’s award-winning World Wide Web site at 
www.ipc.on.ca. The site has been widely recognized 
for being a valuable resource, has won a NetGuide 
Gold Site Award, and twice been chosen as the Ethic 
Connection's Site of the Week. 

The Web site has been designed to help you — 
whether you need help with an access or privacy prob- 
lem, want to learn more about these issues, or just 
want to learn more about the IPC. 

The site is organized into a number of major sec- 
tions. The first, What's New!, lists recent additions, 
including the latest IPC orders and investigation 
reports, policy papers, news releases, and speeches. 
The next section, Our Role, describes who we are and 
what we do. It outlines our statutory mandate and pro- 
vides links to the municipal and provincial Freedom of 
Information and Protection of Privacy Acts (also found 
in the Ontario's Access & Privacy Acts section along 
with accompanying plain language guides). Other 
information includes Annual Reports, three-mini- 


sections on Frequently Asked Questions (on access to 


information, making an appeal, and protecting your 


privacy), and information about the Commissioner. 
A key element is the IPC Code of Procedures, which 
includes Practices, background documents, and forms. 

A major section of the site is dedicated to Orders, 
Investigations and Judicial Reviews. Individual docu- 
ments can be located using Subject and Section 
Indices or by using the search engine. 

One of the most popular sections of the IPC Web 
site is Access & Privacy Matters. From this section, 
visitors can read or download policy papers, special 
Practices (many of which were issued with policy 
papers), Perspectives (a semi-annual newsletter), If you 
wanted to know... (a new series focussing on topical 
issues), and a list of Areas of Interest indicating the 
issues that are tracked by the IPC. Visitors may also 
want to check out Other Sites of Interest, which offers 
links to other sites dedicated to privacy and access to 
information, 

How to Reach Us provides mail, phone, and fax 
information. 

To help people find their way around the site, there 
are a number of useful options. Visitors can currently 
choose between using the framed version of the site 
(which maintains a constant navigation menu on the 
left-hand side of the screen) or a non-framed version. 
There is also a French-language version. Additionally, 
Quick Links lists commonly used pages within the IPC 
Web site. The section Where to Find Things is an 
overview map of the IPC site while Search will help you 
locate specific words or phrases anywhere in the site. 

Every attempt is made to make the Web site easy 
to use. The design and content of the IPC Web site are 
continually reviewed, with plans to revise the site in 
1999. If you have suggestions regarding the site layout 
or resources available online, please send them to 


bspence@ipc.on.ca. Your comments are appreciated. 
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Organizational chart 
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Financial 


statement 


1998-99 1997-98 1997-98 

ESTIMATES ACTUAL ESTIMATES 

Salaries & Wages $4,532,100 $3,607,678 $4,732,100 
| Roc Benefits $861,100 $828,957 $923,800 
Beicnortation and Communication $141,400 $90,785 $141,400 
ae $823,800 $559,100 $668,800 
Supplies and equipment $151,800 $262,577 $106,800 
Total Expenditures $6,510,200 $5,349,097 $6,572,900 


Note: The IPC's fiscal year begins April 1 and ends March 31. The financial administration of the IPC is audited 
on an annual basis by the Provincial Auditor. 


Appendix 1 


As required by the Public Sector Salary Disclosure Act, 1996, the following chart 


shows which IPC employees received more than $100,000 in salary and benefits 


during 1998 

NAME POSITION SALARY PAID TAXABLE BENEFITS 
Cavoukian, Ann Commissioner $127,924.96 $368.64 
TER Tom necieeaut Res. ; $124, eee $345.00 
AÉTAE ee Deco of Énporte ne | $120,357.80 $344.16 

& General Counsel 

Challis, William for Counsel | hot $308.56 
Giuffrida, David re cel E for $290.52 
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